Encryption at rest
AES-256 for all customer databases. Keys managed via KMS with periodic rotation.
Security
Security is foundation, not feature.
Built from day one to pass enterprise security reviews. Here is what is under the hood, and what we are working on next.
Controls in production today
The controls a security review team looks for during vendor evaluation, live in the platform right now.
Encryption in transit
TLS 1.3 for external connections. Internal services run on an isolated private network. Certificates auto-rotated by Let's Encrypt.
Multi-tenant isolation
Hard data boundaries at organization level. Every query is constrained to the active org from the JWT.
Federated identity
JWT RS256, public JWKS for verification. No shared secrets, no duplicated identity DBs.
Full audit trails
Every sensitive action is logged, who, when, which resource. Searchable, exportable.
EU data residency
Available for every product. Data stays on EU servers in Frankfurt. Sovereign deployment adds full isolation for strict residency needs.
Sovereign deployment
Private cloud or air-gapped on-premise for customers with strict residency requirements. Contact us.
GDPR rights built-in
Data export (Article 20) and deletion (Article 17) ship in every account. No ticket needed.
Compliance status, candidly
A check means shipped today. A half mark means in progress with a target date. No enterprise-ready claims for things that have not shipped yet.
Encryption at rest + in transit (AES-256, TLS 1.3)
Multi-tenant isolation at the database level
Audit trails for every sensitive action
GDPR self-service export + deletion rights
EU data residency (every product)
Sovereign deployment (private cloud + air-gapped)
TOTP two-factor authentication (in progress, Q3 2026)
SSO / SAML (in progress, Q4 2026)
SOC 2 Type II certification (targeted, Q2 2027)
ISO 27001 certification (targeted, H2 2027)
Responsible vulnerability disclosure
If you discover a security vulnerability, we want to hear from you. Send details to contact@amargicreative.com. We will respond within 48 hours with an acknowledgment and remediation timeline. We credit researchers who report responsibly and follow coordinated disclosure.
Frequently asked questions
Is my data encrypted?
AES-256 for all customer databases at rest, with KMS-managed keys and periodic rotation. TLS 1.3 for external connections in transit; internal services run on an isolated private network. Certificates managed by Let's Encrypt + ACME.
Is my data isolated from other customers?
Hard data boundaries at organization level. Every database query is constrained to the active org from the JWT, one product cannot read another product's data without explicitly going through Amargi Workspace.
Where is my data stored?
EU data residency is the default for every product (Hetzner, Frankfurt). Customers requiring residency in a different region or full self-hosting can use sovereign deployment options, private cloud or air-gapped on-premise.
Is Amargi SOC 2 / ISO 27001 certified?
Not yet. SOC 2 Type II certification is targeted for Q2 2027 and ISO 27001 for H2 2027. We do not make enterprise-ready claims for things that have not shipped, this is candid status, not aspirational.
How do I report a security vulnerability?
Email contact@amargicreative.com. We respond within 48 hours with an acknowledgment and remediation timeline. We credit researchers who report responsibly and follow coordinated disclosure.
Need security documentation for vendor review?
Contact us, we provide security questionnaires, architecture documents, and sovereign-deployment details on request.